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TO ALL WHOM IT MAY CONCERN: 

Be it known that we, Gopal Parupudi, a citizen of India 
residing at 4221 255th Place SE, Issaquah Washington 98029, 
Mario C. Goertzel, a citizen of the United States, residing at 
12 631 NE 107th Place, Kirkland, Washington 98033, and Murthy 
Srinivas, a citizen of the United States residing at 9611 
213th Avenue NE, Redmond, Washington 98053, have invented a 
certain new and useful SYSTEM EVENT NOTIFICATION SERVICE of 
„which the following _is _a ..specification^ 



SYSTEM EVENT NOTIFICATION SERVICE 
TECHNICAL FIELD 

The invention relates generally to computer systems, and 
5 more particularly to an improved method and mechanism for 

providing computer application programs with computer system 
events, including network events. 

BACKGROUND OF THE INVENTION 

10 At times, application programs need or could benefit from 

™ certain system event information. By way of example, an 

J application program that deals with a network may need to 

m determine if the network is available to that program, i.e., 

Rj whether the computer system is connected to the network and 

=15 the network is operational. Another application program, such 

i~"~'z 

TU as a word processing program, may benefit from knowing if the 
4i state of battery charge was getting critically low, whereby 
^ the application program could automatically save a copy of any 
open files . 

20 To -the extent - that - such system . information . may be 

obtained, the mechanisms for obtaining the information are 
independent within the various applications. For example, 
each application that deals with the network essentially 
implements its own technology to determine the state of 
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network connectivity. Such technology uses often crude and 
incomplete heuristics for this purpose. 

Moreover, because many system events such as battery low 
conditions and network disconnects can happen at any time, - 
5 some regular calling or polling mechanism is generally needed 
to detect such conditions. However, such polling consumes 
resources, which is particularly wasteful since the result is 
usually unchanged. At the same time, individual polling is 
redundant. For example, if some system facility (such as an 
_10 application programming interface, or API) reports the charge 

5"7*Ti 

S of the battery, a word processor, spreadsheet and another 

I application each may be configured to separately and regularly 

Si poll the facility to determine the charge. 

T Particular problems arise with mobile computing, since in 

Si 5 mobile computing environments, users often change the state of 
W network connectivity. At the same time, local area network 
5 (LAN) connectivity is particularly difficult to detect, since 
there is not any uniform way to determine the state of LAN 
connectivity,- e.g., LAN cards do not adequately provide the 
needed connectivity information. Simply monitoring for 
activity is not sufficient, since even if there is activity on 
a LAN interface, such activity may be only broadcast / 
loopback activity, and not indicative of real network 
connectivity. In short, applications heretofore have not had 
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an integrated model for obtaining computer system event 
information, including network connectivity and other 
information. 

5 SUMMARY OF THE INVENTION 

Briefly, the present invention provides a method and 
system for providing system event notifications to clients 
such as applications. Clients register for notification of 
one or more types of events with a registration mechanism, and 
^10 a System Event Notification Service, (SENS) , receives system 
£ event information and fires events in response thereto. A 
2 distribution mechanism selectively communicates the fired 
| event to each client registered for notification thereof based 
f on the type of event. SENS preferably uses the Loosely 
Kl5 Coupled Events database to match client subscribers interested 
in the information SENS is capable of publishing. 
! For network events, the System Event Notification Service 

monitors the connectivity state of the machine. SENS provides 
the connectivity state information via an application .. 
20 programming interface (API) or by sending notifications to 

subscribers via the distribution mechanism. The information 
may include whether the connection is established or lost, the 
type of connection (LAN / WAN) and bandwidth information. 
SENS also provides information on other system events, 
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including logon or logoff operations and power management, and 
may be extended to provide other types of system event 
information such as notifications of plug and play operations. 
To monitor a LAN state, SENS caches outgoing and 
5 incoming network information including errors and packet 
counts. SENS evaluates this cached information against 
current information to determine whether the connection is 
available or not and additionally to determine if a connection 
was established or lost. SENS also evaluates the WAN state if 
_10 RAS (Remote Access Services) is installed. SENS further 
| determines if a destination (IP address or name) is reachable, 
S by periodically polling destinations, preferably via system 
S threadpool timers. To monitor events such as logon/logoff or 
f power management, SENS registers with the operating system. 
Sl5 SENS may also interface with one or more other clients to 
W delay logging off until the other client or clients can 
^ complete certain work. 

Other advantages will become apparent from the following 
- - ~ detailed description when taken in conjunction with .the. 
20 drawings, in which: 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIGURE 1 is a block diagram representing a computer 
system into which the present invention may be incorporated; 
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FIG. 2 is a block diagram representing general components 
for distributing system events to registered clients in 
accordance with one aspect of the present invention; 

FIG. 3 is a block diagram representing a centralized 
5 service and mechanism for firing event notifications, and 
interfaces in a client registered for notifications, in 
accordance with one aspect of the present invention; 

FIG. 4 is a block diagram representing sources for 
triggering a network connectivity state evaluation and 
10 components therefor in accordance with one aspect of the 
S present invention; 

ffi FIG. 5 is a representation of a cache for maintaining 

m local area network information to evaluate the network 
r connectivity state in accordance with one aspect of the 

fUl5 present invention; 

W FIG. 6 is a flow diagram generally representing the steps 

^ taken to evaluate the connectivity state of a local area 

network and for firing corresponding network system events in 
accordance with one aspect of the present invention; 

FIG. 7 is a flow diagram generally representing the steps 
taken to determine whether a specified network destination is 
reachable and for firing corresponding network system events 
in accordance with one aspect of the present invention; 
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FIG. 8 is a representation of a cache for periodically 
polling network destinations to determine the reachability 

thereof; and 

FIG. 9 is a representation of a thread pooling 
arrangement useful for periodically polling network 
destinations to determine the reachability thereof. 



DETAILED DESCRIPTION OF THE INVENTION 

Exemplary Operating Environment 
_10 FIGURE 1 and the following discussion are intended to 

% provide a brief general description of a suitable computing 
| environment in which the invention may be implemented. 
% Although not required, the invention will be described in the 
t general context of computer-executable instructions, such as 
Sl5 program modules, being executed by a personal computer. 
W Generally, program modules include routines, programs, 
^ objects, components, data structures and the like that perform 
particular tasks or implement particular abstract data types. 

Moreover, those skilled in the -art will appreciate that the 

20 invention may be practiced with other computer system 

configurations, including hand-held devices, multi-processor 
systems, microprocessor-based or programmable consumer 
electronics, network PCs, minicomputers, mainframe computers 
and the like. The invention may also be practiced in 
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distributed computing environments where tasks are performed 
by remote processing devices that are linked through a 
communications network. In a distributed computing 
environment, program modules may be located in both local and 
5 remote memory storage devices. 

With reference to FIG. 1, an exemplary system for 
implementing the invention includes a general purpose 
computing device in the form of a conventional personal 
computer 20 or the like, including a processing unit 21, a 
^10 system memory 22, and a system bus 23 that couples various 
\ system components including the system memory to the 

processing unit 21. The system bus 23 may be any of several 
Si types of bus structures including a memory bus or memory 
T controller, a peripheral bus, and a local bus using any of a 
Sjl5 variety of bus architectures. The system memory includes 

Til 

W read-only memory (ROM) 24 and random access memory (RAM) 25. 
^ A basic input/output system 26 (BIOS), containing the basic 
routines that help to transfer information between elements 
within the personal computer 20, such as during start-up, is 
stored in ROM 24. The personal computer 20 may further 
include a hard disk drive 27 for reading from and writing to a 
hard disk, not shown, a magnetic disk drive 28 for reading 
from or writing to a removable magnetic disk 29, and an 
optical disk drive 30 for reading from or writing to a 
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removable optical disk 31 such as a CD-ROM or other optical 
media. The hard disk drive 27, magnetic disk drive 28, and 
optical disk drive 30 are connected to the system bus 23 by a 
hard disk drive interface 32, a magnetic disk drive interface 
33, and an optical drive interface 34, respectively. The 
drives and their associated computer-readable media provide 
non-volatile storage of computer readable instructions, data 
structures, program modules and other data for the personal 
computer 20. Although the exemplary environment described 
herein employs a hard disk, a removable magnetic disk 29 and a 
removable optical disk 31, it should be appreciated by those 
skilled in the art that other types of computer readable media 
which can store data that is accessible by a computer, such as 
magnetic cassettes, flash memory cards, digital video disks, 
Bernoulli cartridges, random access memories (RAMs) , read-only 
memories (ROMs) and the like may also be used in the exemplary 
operating environment. 

A number of program modules may be stored on the hard 
disk, magnetic disk 29, optical disk 31, ROM 24 or RAM 25, . 
including an operating system 35 (preferably Windows® 2000), 
one or more application programs 36, other program modules 37 
and program data 38. A user may enter commands and 
information into the personal computer 20 through input 
devices such as a keyboard 40 and pointing device 42. Other 
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input device, (not shown) may Include a microphone, Joystick, 
game pad, satellite dish, scanner or the like. These and 
other input devices are often connected to the processing unit 
21 through a serial port interface 46 that is coupled to the 
system bus, but may be connected by other interfaces, such as 
a parallel port, game port or universal serial bus (USB) . A 
monitor 47 or other type of display device is also connected 
to the system bus 23 via an interface, such as a video adapter 
48. in addition to the monitor 47, personal computers 
typically include other periphera! output devices (not shown, , 
such as speakers and printers. 

The personal computer 20 may operate in a networked 
environment using logica! connections to one or more remote 

„..„ ™m,tpr 49 The remote computer 
computers, such as a remote computer 

49 may be another personal computer, a server, a router, a 
network PC, a peer device or other common network node, and 
typically includes many or all of the elements described above 
relative to the personal computer 20, although only a memory 
storage device 50 has been illustrated in FIG . 1. The logical 
connections depicted in FIG. 1 include a local area network 
(LAN) 51 and a wide area network (WAN) 52. Such networking 
environments are commonplace in offices, enterprise-wide 
computer networks, Intranets and the Internet. 
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When used in a LAN networking environment, the personal 
computer 20 is connected to the local network 51 through a 
network interface or adapter 53. When used in a WAN 
networking environment, the personal computer 20 typically 
includes a modem 54 or other means for establishing 
communications over the wide area network 52, such as the 
internet. The modem 54, which may be internal or external, is 
connected to the system bus 23 via the serial port interface 
46. in a networked environment, program modules depicted 
relative to the personal computer 20, or portions thereof, may 
be stored in the remote memory storage device. It will be 
appreciated that the network connections shown are exemplary 
and other means of establishing a communications link between 
the computers may be used. 



EVENT NOTIFICATION 

Turning now to FIG. 2, the System Event Notification 
Service 60 (SENS) is a centralized mechanism which publishes 

' notif ^ications- to-appfopriat. clients- 62, - -62,.- ---Clients. are_ _. 
subscribers that essentially subscribe via a registration 
mechanism 64 for events in which they are interested. When 
the SENS 60 receives system event information corresponding to 
an event for which a client is registered, the SENS 60 fires 
an event to a distribution mechanism, preferably embodied in a 



COM object referred to as an event class object 66, which in 
turn publishes the event to only those client subscribers €2 1 - 
62 n that are registered for that event. A filtering mechanism 
68 may also be included as part of the event class object 66 
or connected thereto, whereby certain events are filtered out 
based on client-specified conditions (i.e., parameters) that 
may be associated with an event. For example, the client can 
register for a notification of when the computer system is on 
battery power, but further specify that notification should 
only occur if the battery charge is at or below twenty 
percent. The filtering mechanism stops the fired event 
notification from reaching that client unless the battery 
charge is below the specified twenty percent level. 

Although not necessary to the present invention, the 
registration mechanism 64, distribution mechanism (event class 
object) 66 and filtering mechanism 68 used by the SENS 60 are 
preferably incorporated into a C0M+ events database-like 
technology generally referred to herein as the Loosely Coupled 
Events database 70. The Loosely Coupled Events database 70 
and associated filtering mechanism 68 are described in more 
detail in copending United States patent applications, 
entitled 'Object Connectivity Through Loosely Coupled Publish 
And Subscribe Events," and 'Object Connectivity Through 
Loosely Coupled Publish And Subscribe Events With Filtering," 




respectively, both assigned to the assignee of the present 
invention, filed concurrently herewith, and hereby 
incorporated by reference herein in their entireties. These 
applications will hereinafter be referred to as the 
5 aforementioned 'Loosely Coupled Events" applications. 

Thus, aspects of the present invention are herein 
described with reference to the Loosely Coupled Events model, 
which is incorporated into an object services component of 
Microsoft Corporation's Windows® 2000 (server) operating 
10 system. In general, the Windows® 2000 operating system is a 
! scaleable, high-performance network and computer operating 
i system supporting distributed client / server computing, and 
j provides an object execution environment for component 

applications, including those conforming to the component 
nJl5 object model (COM) . COM is described in detail in "Inside 
W OLE, Second Edition", Kraig Brockschmidt, Microsoft Press 

(1995) . The COM+ component incorporates object services that 
implement the illustrated publish and subscribe event 
communication model. As used herein, 'COM" is used to refer 
20 to the object model defined in the Microsoft Component Object 
Model, whereas *C0M+"' refers to the system services, system- 
provided objects and system-defined interfaces of the COM+ 
object services component of Microsoft Windows® 2000. 
Notwithstanding, there is no intention to limit the present 
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invention to the Windows® 2000 operating system, COM and/or 
COM+, but on the contrary, the present invention is intended 
to operate with and provide benefits with any mechanism that 
fires and distributes event notifications in response to 
receiving system information. For example, the present 
invention has also been implemented in Microsoft® 
Corporation's Internet Explorer 5.0 for Windows NT 4.0 and 
Windows® 95 and Windows® 98 operating systems. 

The Loosely Coupled Events database 70 includes 
information about the event publisher (i.e., SENS), event 
subscribers, and filters. During setup, when Microsoft® 
Windows 2000® is installed or upgrades another operating 
system, the SENS 60 adds itself as a publisher to a COM+ 
Events data store, and provides information on the classes of 
events that it monitors using a QUID for each class of events. 

In the Loosely Coupled Events model, the SENS 60 is a 
publisher that fires events to the distribution mechanism, the 
aforementioned COM object referred to as the event class 
object 66. More particularly, the SENS 60 calls a method of 
an interface (e.g., 72 2 ) of the event class object 66, which in 
turn handles the work of publishing the event to the client 
subscribers 62> - 62 n registered for the event. For purposes 
of simplicity herein, calling a method of a COM object will 
not be described in detail, since such an operation is well 



documented. The work performed by the event class object 66 
includes retrieving subscription information, creating the 
client subscriber (object) if not running, and multi-casting 
the event via method calls to the individual subscribers. 

More particularly, the event class object 66 
(distribution mechanism) calls methods or APIs of the 
registration mechanism 64 (e.g., COM + Events subscription 
retrieval / enumeration APIs) when an event is 'fired" by the 
SENS 60, so as to pass the event to the appropriate 
subscribers to the event. Note that the interfaces 72, - 72 m 
of the event class object 66 are ordinarily defined by the 
developer of the SENS 60 publisher to handle the events fired 
thereby. Note further that the Loosely Coupled Events 
database 70 communicates with the SENS 60 so that certain 
types of events are not fired unless at least one client has 
registered for that type of event, since firing events can be 
costly in terms of consuming system resources. 

The SENS 60 is an event publisher for the classes of 
events that it monitors, including network, logon, and power / 
, battery events, and the client application program receiving a 
notification is called an event subscriber, as described 
below. While the SENS 60 is primarily for local system 
events, the distributed component object model (DCOM) enables 
the SENS 60 to be extended to network clients. 
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The client subscribers 6 2l - 62„ are also COM Objects in 
the Loosely Coupled Events model, each of which .ay have a 
subscription to a method or methods of the interface 72 2 . 
application programs typically create a sin, object (FIG. 3, 
to receive appropriate notifications. The subscriptions cause 
the event class object 66 of the Loosely Coupled Events 

4-^ ownt-s fired on the methods to the 
database 70 to propagate events urea 

• vrr ? « 62, - 62 2 , but not 62 n . To 
subscribers, shown in FIG. 2 as bZ, 

- individually expose 
this end, the client subscribers 62, 62 2 

Tprr o ac; the interfaces 74i 
one or more interfaces, shown m FIG. 2 as the 

, . 11w Hpfined identically to 
74„. Each such interface is essentially defined 

one of the interfaces 72, - 72.. The event class object 66 
propagates the event by calling the method of each of the 
subscriber's interfaces (e.g., 74, and 74 2 , that corresponds to 
the method called by the publisher in that event class 
object's interface (e.g., 72 2 ) . 

N ote that an application (e.g., its sin, object receiving 
the notification, does not have to be active (running, when 
the notification is sent. When an" application subscribes to 
, recei ve notifications, the application may specify whether it 
should be activated when the event occurs or notified later 
when it is active. The subscription can be transient and 
valid only until the application stops running, or it can be 



- 15 - 



,40 



m.5 



persistent and valid until the application is removed from the 

system. 

To selectively associate clients with events, the Loosely 
Coupled Events database 70 includes subscription objects 76, - 
76,. Each object (e.g. 76 2 ) associates a particular subscriber 
(e.g., client 62.) and a particular method of an event 
interface (e.g. 72 2 ) of a particular event class object, (e.g., 
the event class object / SENS distribution mechanism 66) . To 
create the subscription / association, the registration 
mechanism 64 includes C0M + services in the form of methods or 
APIs that can be called to register, remove or modify 
subscriptions, (as well as to retrieve or enumerate 
subscriptions to a particular outgoing-event interface 
method) . More particularly, each client subscribes to the 
SENS events that interest it via lEventSubscription and 
lEventSystem interfaces in the COM + Events registration 
mechanism 64. An identifier for the event classes is 
supplied, along with the SENS publisher identifier, 

•SENSGUID_PUBLISHERV- -Subscriptions are- on- a-per-event level,, _ 

whereby the subscribing application -also specifies which 
events within the class are of interest thereto. As described 
above, each event corresponds to a method in the interface 
corresponding to its event class. 
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The client subscriber objects 62 1 - 62 n may implement the 
code that calls the method or API of the registration 
mechanism 64 for registering a subscription, so as to 
subscribe to a particular interface method. Alternatively, 
other programs may use the subscription registration method or 
API of the registration mechanism 64 to enter a subscription 
for a subscriber object. Accordingly, the clients 62i - 62 n 
need not include code to register a subscription. Instead, 
subscriptions can be entered for the client subscriber object 
(e.g., 62 2 ) by other programs. For example, an installation 
program that is run at installation of the subscriber object 
on the computer system 20 may enter a subscription, as may 
other component programs of an application that incorporates 
the subscriber object. Similarly, an administration utility 
such as "Microsoft Management Console," may configure 
subscriptions for the subscriber object. Additional details 
on publishers, the event class object, subscribers, and 
subscriptions are set forth in the aforementioned 'Loosely 
Coupled Events" patent applications. 

Thus, the SENS 60 enables applications to receive 
notifications from system events that SENS 60 monitors. When 
the requested event occurs, the SENS 60 notifies the 
application. At present, the SENS 60 can notify applications 
about three classes of system events, including TCP/IP network 
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events, such as the status of a TCP/IP network connection or 
the quality of the connection, user logon events, and battery 
and AC (alternating current) power events. 

An application can subscribe to multiple system events, 
5 such as establishment of network connectivity, notification 
when a specified destination can be reached within specified 
Quality of Connection (QOC) parameters, and when the computer 
has switched to battery power. The application can also 
subscribed to be notified when the percentage of remaining 

^40 battery power is within a specified parameter, or when other 

S scheduled events occur. 

S m accordance with one aspect of the present invention, 

m one way in which a client (e.g., application) can determine 
T network connectivity information is via application 
Sl5 programming interfaces to the SENS 60, IsNetworkAlive () and 
W IsDestinationReachableO . The IsNetworkAlive () function 
m determines whether the local system is connected to a network 
and the type of network connection, for example, LAN, WAN, or 

both • The isDes t inat ionReachable-(-)- -function determine s if ..the 

specified destination can be reached, and provides Quality of 
Connection (QOC) information for the destination. Additional 
details are set forth below: 
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Bool IsNetworkAlive ( Q . • „ 

LPDWORD lpdwFlags II Specifies the type of network connection 

) ; 

5 

Parameters 

lpdwFlags ^ . . , , , 

Provides information on the type of network connection available 
when the return value is TRUE. The flags can be: 
10 NETWORK ALIVE_LAN 

the computer has one or more LAN cards that are active. 

NETWORK ALIVE_WAN 

the computer has one or more active RAS connections. 

15 Return Values 
TRUE 

The local system is connected to a network. 

FALSE . . . . 

Call GetLastError to determine the reason for no connectivity. 

20 

5 ThiTfunction is used by applications that want to know whether 
~ there is network connectivity before proceeding with network 
iS operations. Applications such as directory service applications, 
m5 mail clients, or Internet browsers can adapt to various kinds of 
m network connectivity. For example, a printing operation can be 
Si deferred until the network connection is available. Note that at 
1 present, this function is only available for TCP/IP connections. 

HBO Bool IsDestinationReachable ( 

m LPCSTR IpszDesination, II Pointer to string specifying 

S de LPQOCINFO lpQOCInfo II Pointer to Quality of Connection 

■j\ information 
"35 ) ; 

Parameters 

IpszDestination . . . „ 

Pointer to a string that specifies the destination. The destination 
40 can be an IP address, a UNC name, or an URL. 
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Pointer to the QOCINFO structure that receives the Quality of 
Connection (QOC) information. You can supply a NULL pointer if the 
QOC information is not desired. 

Return Values 
TRUE 

The destination can be reached. 
FALSE 

Call GetLastError to determine the reason why the destination cannot 
be reached. 

ThiTfunction is used by client applications to determine the QOC 
information before proceeding with network operations. For 
standalone computers that are directly connected to the network 
through a network card or remote access server (RAS) , this function 
generates minimal network traffic with RPC calls to the nearest 
router. For computers that are part of a network where the 
destination can be reached using RAS or a network gateway, this 
function pings to the destination to generate accurate QOC 
information. Note that at present, this function is only available 
for TCP/IP connections. 

The caller supplies the buffer for the QOCINFO structure and must 
release this memory when' it is no longer needed. 



The QOCINFO structure is returned by the isDestinationReachable 
function and provides Quality of Connection information to the 
caller. 

typedef struct tagQOCINFO { 

DWORD dwSize; 

DWORD dwFlags ; 

DWORD dwInSpeed; 

DWORD dwOut Speed; 

} QOCINFO, *LPQOCINFO; 
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Members 

Upon calling the IsDestinationReachable function, the caller 
supplies the size of the QOC structure in this member. On return 
5 from the function, this member contains the actual size of the 
structure that was filled in. 

dwFlags . 

Speed of connection. Flag bits indicate whether the connection is 

slow, medium, fast. 
10 dwInSpeed , 

Speed of data coming in from the destination in bytes per second. 

dwOutSpeed 

Speed of data sent to the destination in bytes per second. 



15 In accordance with another aspect of the present 

invention, another way in which a client (e.g., application) 
Q receives system events is by subscribing a sink object 80 or 
HJ the like for notifications of events that interest it. As 
5 shown in FIG. 3, the subscriber application creates a sink 
%0 object 80 with an implementation for each interface that it 
handles. The various types of events are generally 
categorized into appropriate interfaces, i.e., network-type 
i events in one interface, power-type events in another 

interface, logon-type events in another interface and so on. 
25 FIG. 3 shows such a client subscriber sink object 80 set up to 
receive a relatively large number of SENS events, including 
network-type events via an ISensNetwork interface, power-type 
events via an ISensOnNow interface and logon-type events via 
an ISensLogon interface. Also, plug-and-play type events may 
30 be handled by the SENS 60, and although not presently 
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implemented, are shown herein to illustrate the extensibility 
of the present invention by simply adding additional 
interfaces such as ISensPnP with appropriate methods. Of 
course, a typical sink object ordinarily will not implement 
this many events, however FIG. 3 illustrates many of the 
possible events. The SENS 60 predefines an outgoing interface 
for each event class in a type library, as set forth in Table 
1 below: 

Table 1 



Event Class 

Network events 
Logon events 
Power events 



GUID 

SENSGUID_EVENTCLASS_NETWORK 
S ENS GUI D_E VENT CLAS S_LOGON 
SENSGUID EVENTCLASS ONNOW 



Interface 

ISensNetwork 

ISensLogon 

ISensOnNow 



The SENS 60 defines the SENS coclass as part of the SENS 
type library. The SENS object implementation is provided by 
the operating system, as set forth in Tables 2 and 3 below. 



Table 2 - Creation/Access Functions 


CoCreatelnstance 


Creates an instance of the SENS object 
using its CLSID. 


Table 3 - Interfaces 


ISensNetwork 


Default v -Outgoing interface- implemented by. 
sink object in subscriber application. 


ISensOnNow 


Outgoing interface implemented by sink 
object in subscriber application. 


ISensLogon 


Outgoing interface implemented by sink 
object in subscriber application. 



The ISensNetwork interface handles network events fired 
by the SENS 60. Each event corresponds to a method in the 



ISensNetwork interface, an outgoing interface defined by the 
SENS 60 and implemented by the subscriber application as a 
dispatch interface. The following table, Table 4, sets forth 
the methods of the ISensNetwork interface that correspond to 
network events: 



ISensNetwork Methods 


Description 


ConnectionMade 


Specified connection has been 
established. 


Connect ionMadeNoQOCInfo 


Specified connection has been 
established with no Quality of 
Connection information available. 


Connect ionLost 


Specified connection has been dropped. 


DestinationReachable 


Specified connection can be reached. 


DestinationReachableNoQ 
OCInfo 


Specified connection can be reached with 
no Quality of Connection information. 



FOlo Additional details on some of the methods of the 

ISensNetwork interface are set forth below: 



^15 



ISensNetwork: : ConnectionMade 

The specified connection has been established 
HRESULT ConnectionMade ( 

BSTR bstrConnection, 

UL0N6 ulType, 

LPSENS_QOC INFO IpQOCInfo 



/I Connection name 
// Connection type 

// Pointer to Quality of Connection 
// information 



20 ) ; 



Parameters 
bstrConnection 

[in] The name of the connection. For WAN connections, the 
25 connection name is the name of the phone book entry; for LAN 
connections, it is the name of the network card. 

ulType 

[in] Connection type. This value can be CONNECT I 0N_LAN or 
30 CONNECTION WAN. 
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"[o^t^Pointer to the SENS QOCINFO structure which contains Quality 
of Connection information. 

5 Dispatch Identifier 
[id(OxOOOOOOOl) ] 

Return Values 
S_OK 

10 Method returned successfully. 

Remarks - SENS calls this method to notify an application that the 
specified connection has been established. SENS also provides a 
pointer to a structure containing Quality of Connection information. 



Note that at present, this function is only available for TCP/IP 
connections . 



^20 SENS_QOCINFO Structure 

% The SENS_QOCINFO structure is provided by the 

^ ISensNetwork: :ConnectionMade method and the 

% ISensNetwork: : DestinationReachable method. This structure contains 

%5 Quality of Connection information to the sink object in an 

% application that subscribes to the System Event Notification Service 

Sj (SENS). 

typedef struct __SENS_QOCINFO { 
J" DWORD dwSize; 

%30 DWORD dwFlags; 

51 DWORD dwOutSpeed; 

~ DWORD dwInSpeed; 

} SENSJ20CINFO; 

"%35 Members / 
^ dwSize _ ^ 

This member contains the actual size of the structure that was 

filled in. 
dwFlags 

-4-0- Speed of - connection. ..Flag. bits, indicate whether the connection is 

slow, medium, fast. 
dwOutSpeed 

Speed of data sent to the destination in bits per second. 
dwInSpeed Speed of data coming in from the destination in bits per 
45 second. 
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ISensNetwork : : Dest inat ionReachable 

Directed to whether a specified connection can be reached. 
HRESULT DestinationReachable { 

BSTR bstrDesination, II Destination name 

BSTR bstrConnection II Connection name 

ULONG ultype // Connection type 

LPSENS_QOCINFO IpQOCInfo II Quality of Connection information 

); 

Parameters 
bstrDestination 

[in] Name of the destination. The name may be an IP address, a URL, 
a UNC, or a NetBIOS name. 

bstrConnection 

[in] Name of the connection. For WAN connections, the connection ^ 
name is the name of the phone book entry; for LAN connections, it is 
the name of the network card. 

ulType 

[in] Connection type. This value can be CONNECTION_LAN or 
CONNECT I ON__W AN . 

IpQOCInfo . . 

[out] Pointer to the SENSJ20CINF0 structure which contains Quality 

of Connection information. 

Dispatch Identifier 
[id{0x00000004) ] 

Return Values 
S_OK 

Method returned successfully. 

Remarks ^ . . , 

SENS calls this method to notify an application that the specified 
destination can be reached. A pointer to a structure containing 
Quality of Connection information is also provided. 

Note that at present, this function is only available for TCP/IP 
connections . 

ISensNetwork : : Destinat ionReachableNoQOCInf o 

The specified connection can be reached with no Quality of 

Connection information. 

HRESULT DestinationReachableNoQOCInf o ( 

BSTR bstrDesination, II Destination name 

BSTR bstrConnection, II Connection name 

ULONG ultype // Connection type 

) ; 



Parameters 

U^he ™fof the destination. Can be an IP address, a 0R L, a 

UNO, or a NetBIOS name. 

tlSrSHrS°Sh. connection. For « connections, the connection 
l^L ifthe name of the phone book entry; for LAN connections, it is 
the name of the network card. 

^Connection type. This value can be CONNECTION.!^ or 
CONNECTION_WAN . 

Dispatch Identifier 
[id(0x00000005) ] 

Return Values 
S_OK 

Method returned successfully- 

sSJTcalls this method to notify an application that the specified 
destination can be reached when Quality of Connection xnformatxon » 
not available. 

Note that at present, this function is only available for TCP/IP 
connections . 

Several types of applications, for example, can utilize 
the connectivity functions and notification services that the 
SENS 60 offers. These include an application that requires 
network connectivity status, such as an application that 
utilizes directory services, or an application that adapts its 
operations depending on the level of connectivity and the 
quality of network services, such as an Internet browser that 
functions at a reduced level on a low bandwidth connection. 
Other applications that may benefit from this information 
include an application that can perform deferred operations, 



such as an electronic mail program that can queue messages 
while offline and send them when a connection is established. 

Connectivity functions and notifications are also useful 
for certain computer configurations, such as a mobile computer 
5 used in a docking station on a high bandwidth network which 
may occasionally use a dial-in connection, a mobile computer 
using a dial-in connection exclusively, a desktop computer 
using a dial-in connection exclusively or a desktop computer 
connected to a high bandwidth network with latency issues. In 
jO each of these configurations, the connection bandwidth and 
S latency information can be used by an application to 
I dynamically optimize its operations for network availability. 

1 As described above, LAN cards in general do not provide 
T the appropriate LAN connectivity information needed to 

§L5 appropriately fire system events related thereto. However, in 
W accordance with one aspect of the present invention, the SENS 

2 60 provides a mechanism for detecting the network connectivity 
state, so that it can appropriately fire events in response to 

■ state changes. To this end, as shown in FIGS. 4 and 5, the 
• 20 SENS 60 caches network information in time-based caches 82 T0 
and 82 T2 . The cached information includes Unicast and non- 
Unicast incoming and outgoing network packet counts and 
incoming and outgoing error counts. These counts start at 
zero when the machine is last rebooted, and never decrease 
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(until the next reboot) . For each interface, this information 
is maintained as part of a TCP/IP stack 84 and made accessible 
through internet Protocol Help (IPHLP) APIs 86. As described 
below, a snapshot is taken of the network information at two 
5 distinct times to fill the LAN caches 82 T0 and 82 T2/ and the 
differences in counts evaluated by an evaluation mechanism 88 
within the SENS 60 to determine network connectivity, i.e., 
whether the network is alive (true) or not (false) . 

FIG. 6 shows the general process for determining network 
^LO connectivity, beginning at step 600. One way to trigger the 
A steps of FIG. 6 is when an application program 90 (FIG. 4) or 
| the like calls the above-described IsNetworkAlive ( ) API 91, 
I requesting the network connectivity state information. Also, 
T the SENS 60 can periodically check the state (e.g., once every 
% two minutes) and appropriately fire events on state changes to 
registered clients. Certain other activities can also trigger 
the evaluation of network connectivity, as represented in FIG. 
4 by ovals 92-95. These include plug and play events 92 

directed- to a - LAN - card, - s inee-plugging- or unplugging, such. a. _ 

card is likely to change the state of network connectivity. 
Similarly, certain network user interface activity 93, wherein 
a user can specifically ask to change the network connectivity 
state, may trigger a reevaluation. Remote Access Services 
(RAS) events 94 and Media Sense activity 95 can also trigger a 
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reevaluation of network connectivity. Note that RAS may 
directly provide event information indicating whether a WAN 
connection is alive, which the SENS 60 then utilizes to fire 
events. Further, note that these other events essentially 
5 enter the reevaluation process at step 606, while the API call 
initially evaluates the last state by entering the process at 
step 600. Thus, when an API calls triggers the reevaluation, 
as an optimization, the network connectivity is not checked if 
it is alive (true) and has been checked recently, since 
plO networks do not fail often and evaluating the network 
m information is relatively expensive. However, the network 
m information is evaluated if false, or if one of the certain 
fy circumstances (described above) has taken place, since those 
' events tend to happen when the network connectivity state 

LHl5 changes, regardless of when last checked. 

% If during the IsNetworkAlive ( ) API call the network state 

jig 

was last determined to be true, step 600 branches to step 602 
to test if the time duration, i.e., the current time minus the 

previous time T 0 , presently selected. in one embodiment at 180 

20 seconds, has been achieved since the last time connectivity 

was evaluated. If the duration is less than a threshold time, 
i.e., Ti < To + 180, it is not yet time to check, whereby step 
602 branches to step 604 where a *True" network state is 
returned. Alternatively, as shown in FIG. 6, if the network 
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state is 'False' 7 (step 600) or if the time to check has been 
achieved (T 2 >= T 0 + 180) at step 602, step 606 is next 
executed to fill a time-based cache 82 T2 with network 
information at the current time, T 2 . Note that the first time, 
5 (since reboot), the state is assumed to be false, whereby an 
evaluation of the network information will take place. 

As described above and as represented in FIG. 5, each 
cache (e.g., 82 T2 ) includes various packet and error counts. 
At step 606, the current cache 82 T2 is evaluated against a 
_10 previous cache 82 T0 having the same count information therein, 
J although current interfaces may have been added or removed 

S since the time T 0 . Note that if the cache 82 T0 at time T 0 is 

y = 

| too old or suspect, i.e., few if any of the interfaces are the 
T same, the previous cache 82 T0 can be scrapped, the current 
Sl5 cache 82 T2 can become the previous cache 82 T0 , and after 
13 (possibly) a short delay, new current counts can be obtained 
which become the values in the current cache 82 T2 . In any 
event, the values cached in the cache 82 T2 are statistically 
evaluated against those in the cache 82 T i to determine if the 
20 network connectivity has changed. 

In general, if an incoming packet count has increased 
from time T 2 to T 0 , and the errors are low, the network is 
alive, to a high degree of certainty. Conversely, if the 
outgoing packet counts have increased but the corresponding 
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incoming counts have not relatively increased, the network is 
likely not alive. For example, to determine network 
connectivity, if unicastIN and unicastOUT have changed, the 
network is considered to be alive. Also, if unicastIN and 
unicastOUT have both not changed, AND broadcasts and non- 
unicastOUT have changed by different amounts, the network is 
considered to be alive. However, if broadcasts and non- 
unicastOUT have changed by the same amounts, it is just 
broadcast activity (e.g., the network tap has probably been 
pulled out) , whereby the network is considered to be not 
alive. Moreover, if the Errors IN/ OUT or discards IN/OUT have 
changed, the network is most likely alive and is thus 

considered as such. 

Once the state is determined, in the API call step 610 is 
executed top return the state as a result to the calling 
application. Step 612 is then executed to determine if the 
state has changed from its previous true or false value. If 
the state has changed, the SENS 60 fires the event, Network 
Alive (if True) or Network Not Alive (if false), to provide 
the current state via the Loosely Coupled Events database 70 
to the clients registered therefor. Lastly, at step 616, this 
current state is maintained as the previous state and the 
current cache as the previous cache to be available for the 
next evaluation. 
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In accordance with another aspect of the present 
invention, the SENS 60 also provides an event and/or API 
response as to whether a particular network destination is 
reachable. Applications can call the isDestinationReachable ( ) 
5 API or register for DestinationReachable change events. By 
way of example, rather than simply knowing whether the network 
is alive, an electronic mail program may want to know whether 
its mail server is reachable. To this end, the electronic 
mail program calls the IsDestinationReachable 0 API or 
^0 registers (typically at installation time) with the Loosely 
| Coupled Events database 70 for 'DestinationReachable" 
| notifications, and provides the name of the mail server. The 
I Loosely Coupled Events database 70 then informs the SENS 60, 

T whereby the SENS 60 will find out and thereafter monitor this 

Q 

5l5 destination. The SENS 60 then fires events when the state of 

tz 3 

W the mail server switches from reachable to not reachable and 

= vice-versa. 

To determine destination reachability, the SENS 60 
essentially executes the steps of FIG. -7, beginning at step 
20 700 where a test is made as to whether the destination is 

named or is in the form of an IPjaddress. If named, the SENS 
60 attempts to resolve the name, ji.e., by calling external 
TCP/IP name resolution APIs, and obtaining a result at step 
702. If unable to be resolved, step 704 branches to step 706 
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where the 'not reachable" result is returned to the calling 
program (if called as an API). A 'Ping" cache 98 (FIG. 8) is 
updated at step 708 to reflect the unreachable state before 
branching to step 716, described below. 

If the IP address is known, either at step 700 or via 
steps 702 - 704, step 710 then tests to determine if the IP 
address corresponds to a local subnet (known from the value of 
the address). If so, then the destination is automatically 
considered reachable, and the reachable result is returned to 
the calling program (if called as an API) before branching to 
step 716, described below. Note that when a destination is 
considered reachable by the SENS 60, it is not a guarantee of 
reachability to an application. However local subnets are 
worth trying, and thus a 'reachable" result is returned. 

If the IP address does not correspond to a local Subnet, 
at step 710, the destination may be pinged (i.e., a packet 
sent thereto) to see if it responds, whereby it is known 
whether it is reachable. However, rather than ping each time, 
the ping cache 98 may be maintained that keeps the reachable / 
unreachable states of one or more destinations therein. The 
ping cache 98 is regularly updated while the network is alive, 
for example, each destination in the ping cache 98 is pinged 
once every five minutes. The last pinged state for the 
appropriate destination is returned at step 714 to the 
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application calling the API, although as can be appreciated, 
alternatively the API call can force the ping. 

Steps 716 and 718 cause an event to be fired to 
registered clients if a state change has occurred. For 
example, a name that previously was not resolvable is now 
resolved and it is in the local Subnet, or now responds when 
pinged, or a destination that formerly responded to pings no 
longer responds. Note that as also represented in FIG. 7, the 
ongoing monitoring process of the SENS 60 essentially pings 
each registered destination on a regular basis and then 
performs the steps 716 - 718 to determine whether to fire an 
event . 

A simple way in which to ping destinations is to keep a 
list of destinations and their corresponding reachable or 
unreachable states in the ping cache 98 as shown in FIG. 8. 
Then, a thread unblocks and executes once every time period 
(e.g., five minutes), and loops through the list by pulling 
each destination off of the list and essentially executing the 
-steps of " FIG . "7 there for-, - writing- any- changed result, into .the 
ping table 98. The thread then blocks until again needed. 

However, while effective, the simple looping mechanism 
wastes a thread since most of the time the thread is idle 
while blocking. A more efficient way to perform the same 
pinging loop is to use thread pooling. In thread pooling, 
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each executable is assigned a number of threads lOOx - 100 k , 
(e.g., three or four), plus a single thread (DLL) 102 which 
maintains a timer queue 104 of timed work items, one-time 
queued work items, and/or wait-based work items that wait on 
an event. At present, this provides the ability to wait on 
sixty-two objects with one thread 102. The SENS 60, using 
thread-pooling APIs 106, registers each destination to ping as 
a work item 102! - 102i with the operating system, along with 
any wait-based work items such as RAS connect and disconnect. 
The single thread 102 allocates one or more worker threads 
(e.g., lOOO to work items 102i - 102i in the queue 104 as 
appropriate, i.e., once every time period for ping work items, 
whereby the pinging operation takes place. When not pinging, 
threads may be thus allocated to other processes rather than 
blocking. 

In accordance with another aspect of the present 
invention, the SENS 60 provides notifications of AC and 
battery power events reported by the operating system 35. The 
ISensOnNow interface is implemented by clients interested in 
any of the SENS power events. As described above, this 
interface is an outgoing interface defined by SENS and 
implemented by the subscriber application as a dispatch 
interface. As also described above, when registering for 
battery low notifications, clients can specify filtering 
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• ffl ,f are set forth below in Table 5: 
the ISensOnNow interface, set 



Table 5 



OnACPower -I 



nnRatteryPower 



BatteryLow 



■jvvj - OV/*^^ = 

switched to Battery pow er. 



Battery p ower is low 



Additional details for some of the methods of the 
ISensOnNow interface are set forth below: 

S"n£ C rtSd to notify your application that the colter 

LO is using AC power. 

HRESULT OnACPower (void) ; 



15 



Dispatch Identifier 
[id(OxOOOOOOOl) ] 

Return Values 

S OK _ , ,„ 

Method returned successfully. 



20 Remarks . f application that AC power has 

' S n ££££ appUcitlon^crihes to this event, there 

j are no filters to specify. 
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ISensOnNow: :OnBatteryPower 
.« call, this method to notify an application that the colter rs 
using battery power. 
30 HRESULT OnBa ttery Power ( Percen t of battery power remaining 

DWORD dwBatteryLifePercent // Perce 

) ; 

Parameters 

35 dwBatteryLifePercent k^*™ nower remaining, 

[in] Specifies the percent of battery P 



Dispatch Identifier 
[id(0x00000002) ] 



40 



Return Values 
S_OK 
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Method returned successfully. 

Remarks anniication that the computer is 

filters to specify. 

The SENS 60 also handles additional notifications related 
to various system states via the ISensLogon interface. If any 
clients are interested, the SENS 60 centrally registers to 
find out about these events with the operating system / 
Winlogon service. The client application registers for these 
notifications and implements this ISensLogon interface as 
described above, whereby the SENS 60, via the Loosely Coupled 
Events database 70, calls the ISensLogon methods on the 
appropriately registered sink object to fire the corresponding 
event. The following table, Table 6, describes these events: 

Table 6 



ISensLogon Methods bescription 



^— — A user has logged on. 

LQ g Qn ■ i^ q h f 



Logoff 



StartShell 



A user has logged off* 
shell has been started. 



DisplayLock 



DisplayUnlock 



StartScreenSaver 



StopScreenSaver 



Screen display has b een locked. 



O c^ii ^'■'y* *--r — " — — — 

Screen display has been unlocked. 



grr^n saver has been started. 



Screen saver has be en stopped. 



Lastly, the SENS 60 provides a special facility that may 
be used just before logoff, such as for synchronization 
purposes. As with logon, the SENS 60 registers with the 
operating system for certain event notifications. However, 
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rather than after the event starts, when the SENS 60 receives 
the logoff indication, the SENS 60 fires a logoff event (if a 
client is registered for notification) and then delays the 
logoff process until a client that has registered for logoff 
notification instructs the SENS 60 to continue. This allows a 
client to perform pre-logoff processing after the user has 
requested logoff but before the actual logoff operation 
occurs . 

As can be seen from the foregoing detailed description, 
there is provided a centralized system event notification 
service that notifies registered clients of events. The 
method and system provide information such as network 
information that is otherwise unavailable or inconsistent in a 
consistent, efficient and extensible way. 

While the invention is susceptible to various 
modifications and alternative constructions, a certain 
illustrated embodiment thereof is shown in the drawings and 
has been described above in detail. It should be understood, 
however, that there is no intention to limit the invention to 
the specific form or forms disclosed, but on the contrary, the 
intention is to cover all modifications, alternative 
constructions, and equivalents falling within the spirit and 
scope of the invention. 
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